CS0-003 Incident Response and Management Practice Question
A security analyst is performing dynamic analysis of a suspicious file in a sandbox. Which of the following observations is most indicative of ransomware behavior?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file opens and overwrites documents with a new extension and drops a ransom note
Ransomware typically encrypts files and renames them with a new extension. Dropping a ransom note and leaving encrypted files is characteristic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The file injects code into a legitimate process
Why it's wrong here
While process injection techniques like process hollowing or DLL injection are common evasion methods used to bypass security controls, they are not defining characteristics of ransomware. This behavior is frequently observed across various malware categories, including trojans, rootkits, and spyware, which seek to hide malicious code execution within legitimate system processes like svchost.exe.
- ✓
The file opens and overwrites documents with a new extension and drops a ransom note
Why this is correct
This behavior represents the definitive, high-fidelity signature of ransomware during dynamic analysis. The rapid opening, cryptographic overwriting of user data, appending of a unique file extension, and subsequent creation of a text or HTML ransom note uniquely identify the payload's destructive intent to extort the victim.
- ✗
The file creates a registry run key
Why it's wrong here
Modifying registry run keys, such as those under the Windows CurrentVersion\Run path, is a standard persistence mechanism used by almost all categories of malware to survive system reboots. Because adware, spyware, and remote access trojans also utilize this technique to maintain access, its presence does not specifically classify the analyzed file as ransomware.
- ✗
The file attempts to connect to multiple external IPs
Why it's wrong here
Outbound network connections to multiple external IP addresses typically indicate command-and-control beaconing, scanning activity, or data exfiltration. While ransomware may communicate externally to exchange encryption keys, many other malware types, such as botnets, cryptominers, and downloaders, exhibit this exact network behavior, making it non-diagnostic on its own.
Go deeper
Related to this question
Learn chapter
Ransomware Incident Response
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Analysis
In incident response, analysis is the process of examining data and events to determine what happened, how it happened, and what actions to take.
About these practice questions
One of 701 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.